NIST-SI-16 Memory Protection

Implement the following controls to protect the system memory from unauthorized code execution: [Assignment: controls].

Some adversaries launch attacks with the intent of executing code in non-executable regions of memory or in memory locations that are prohibited. Controls employed to protect memory include data execution prevention and address space layout randomization. Data execution prevention controls can either be hardware-enforced or software-enforced with hardware enforcement providing the greater strength of mechanism.

• T1003.001 LSASS Memory • T1047 Windows Management Instrumentation • T1055.009 Proc Memory • T1059 Command and Scripting Interpreter • T1059.001 PowerShell • T1059.002 AppleScript • T1059.003 Windows Command Shell • T1059.004 Unix Shell • T1059.005 Visual Basic • T1059.006 Python • T1059.007 JavaScript • T1059.008 Network Device CLI • T1059.011 Lua • T1218 System Binary Proxy Execution • T1218.001 Compiled HTML File • T1218.002 Control Panel • T1218.003 CMSTP • T1218.004 InstallUtil • T1218.005 Mshta • T1218.008 Odbcconf • T1218.009 Regsvcs/Regasm • T1218.012 Verclsid • T1218.013 Mavinject • T1218.014 MMC • T1218.015 Electron Applications • T1505.004 IIS Components • T1543 Create or Modify System Process • T1543.002 Systemd Service • T1547.004 Winlogon Helper DLL • T1547.006 Kernel Modules and Extensions • T1548 Abuse Elevation Control Mechanism • T1548.004 Elevated Execution with Prompt • T1565 Data Manipulation • T1565.001 Stored Data Manipulation • T1565.003 Runtime Data Manipulation • T1611 Escape to Host